Well, at this point, it's all idle curiosity on her and your part. The first thing you should have done is image off a couple of copies of that drive. One for archive, the other to examine.

A ram snapshot would have been good as well.